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Information Commissioner’s Office 


Official information held in private email 
accounts 


Freedom of Information Act 


The Freedom of Information Act 2000 (FOIA) gives rights of public 
access to information held by public authorities. 


An overview of the main provisions of FOIA can be found in the 
Guide to Freedom of Information. 


This is part of a series of guidance, which goes into more detail than 
the Guide to FOIA, to help you as a public authority to fully 
understand your obligations, as well as promoting good practice. 


This guidance is intended to clarify the legal status under FOIA of 
information relating to the business of a public authority held in 
private email accounts in particular, but also other media formats. 
This is an emerging area of FOIA compliance and so the guidance 
may be updated in due course. 


This guidance does not deal with exemptions which might be 


applicable to information held in private email accounts, only 
whether it may be held for the purposes of FOIA. 


Overview 


e FOIA applies to official information held in private email 
accounts (and other media formats) when held on behalf of 
the public authority. Such information may be exempt and will 
not necessarily have to be disclosed. 

e It may be necessary to request relevant individuals to search 
private email accounts in particular cases. The occasions 
when this will be necessary are expected to be rare. 

e Adherence to good records management practice should 
assist in managing risks associated with the use of private 
email accounts for public authority business purposes. 
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What FOIA says 


Section 3 sets out the two legal principles by which it is established 
whether information is held for the purposes of FOIA. 


3. 
(2) For the purposes of this Act, information is held by a public 
authority if— 


(a) it is held by the authority, otherwise than on behalf of another 
person, or 


(b) it is held by another person on behalf of the authority. 


Under section 3(2)(a) information will be held by the public 
authority for the purposes of FOIA if it is held to any extent for its 
own purposes. Only if information is held solely on behalf of another 
person will the public authority not hold it for the purposes of FOIA. 


Section 3(2)(b) provides that in circumstances where information is 
held by another person on behalf of the public authority, the 
information is considered to be held by the authority for the 
purposes of FOIA. It is this sub-section that is of relevance to 
information held in personal email accounts. 


The Commissioner’s approach 


Information held in non-work personal email accounts (e.g. Hotmail, 
Yahoo and Gmail) may be subject to FOIA if it relates to the official 
business of the public authority. All such information which is held 
by someone who has a direct, formal connection with the public 
authority is potentially subject to FOIA regardless of whether it is 
held in an official or private email account. If the information held in 
a private account amounts to public authority business it is very 
likely to be held on behalf of the public authority in accordance with 
section 3(2)(b). 


This can apply to any public authority. For example, a Councillor 
may hold information relating to local authority business in his/her 
private email account on behalf of the local authority. The 
Commissioner is aware that the issue has also arisen in a central 
government context in relation to the use of non-work systems. 
There is a need to have a clear demarcation between political and 
departmental work. In the local government context, there is a 
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need to have a clear demarcation between Council business and 
work for individuals as their local representative. 


Information in private email accounts that does not relate to the 
business of the public authority will not be subject to FOIA. 


Situations where information legitimately requested under FOIA 
includes relevant information held on private email accounts will be 
rare. However, when a request for information is received, public 
authorities should consider all locations where relevant information 
may be held. This may include private email accounts. 


The ICO recommends that, as a matter of good practice, public 
authorities establish procedures for dealing with such situations. 
These should outline the relevant factors to be taken into account in 
deciding whether it is necessary to ask someone to search their 
private email account for information which might fall within the 
scope of an FOI request the public authority has received. Relevant 
factors are likely to include: 


e the focus of the request, indicated by the words used by the 
requester; 

e the subject matter of the information which falls within the 
scope of the request; 

e how the issues to which the request relates have been 
handled within the public authority; 

e by whom and to whom was the information sent and in what 
Capacity (e.g. public servant or political party member); and 

e whether a private communication channel was used because 
no official channel was available at the time. 


Where a public authority has decided that a relevant individual’s 
personal email account may include information which falls within 
the scope of the request and which is not held elsewhere on the 
public authority’s own system, it will need to ask that individual to 
search their account for any relevant information. 


The enquiries made should be directed towards deciding whether 
any information which is so held was generated in the course of 
conducting the business of the public authority. If it was, it is likely 
to be within the scope of the request. It will therefore be held by 
the individual on behalf of the public authority for the purposes of 
FOIA. 


Where members of staff or other relevant individuals have been 
asked to search private email accounts for requested information, 


Official information held in private email accounts 3 
20170309 
Version: 1.2 


there should be a record of the action taken. The public authority 
will then be able to demonstrate, if required, that appropriate 
searches have been made in relation to a particular request. The 
Commissioner may need to see this in the event of a section 50 
complaint arising from the handling of the request. 


Relevant information in other forms 


Although the main emphasis of this guidance is on information held 
in private email accounts, public authorities should be aware that it 
applies to information in other forms. The definition of information 
under FOIA is provided at section 84 and states that ““information” 
... Means information recorded in any form”. Therefore, official 
information recorded on mobile devices, including text messages on 
mobile phones, or in any other media, may also be considered to be 
held on behalf of the public authority in the circumstances outlined 
in this guidance. Again, this does not necessarily mean that such 
information will be disclosable, but, on receipt of a valid FOIA 
request, public authorities should consider all locations where the 
requested information may be found. 


Concealment and deletion 


Public authorities should also remind staff that deleting or 
concealing information with the intention of preventing its disclosure 
following receipt of a request is a criminal offence under section 77 
of FOIA. For example, where information that is covered by a 
request is knowingly treated as not held because it is held ina 
private email account, this may count as concealment intended to 
prevent the disclosure of information, with the person concealing 
the information being liable to prosecution. 


Records Management 


The Lord Chancellor’s Code of Practice under section 46 of FOIA 
stresses the importance, and benefits, of having good records 
management. As such, public authorities are strongly advised to use 
their records management policies to clarify the types of 
information that could be considered as records relating to the 
public authority’s business. These policies should include clear 
advice to staff that recorded information held by individuals, 
regardless of the form in which it is held, and which relates to the 
business of the authority, is likely to be held on behalf of the 
authority and so subject to FOIA. 
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In order to avoid the complications of requesting searches of private 
email accounts, and other private media, records management 
policies should make clear that information on authority-related 
business should be recorded on the authority’s record keeping 
systems in so far as reasonably practicable. 


It is accepted, that in certain circumstances, it may be necessary to 
use private email for public authority business. There should be a 
policy which clearly states that in such cases an authority email 
address must be copied in to ensure the completeness of the 
authority’s records. In this way, records management policies will 
make it easier for public authorities to determine whether 
information is held and to locate and retrieve it in response to 
requests. If the information is contained within the public 
authority’s systems it can also be subject to consistently applied 
retention and destruction policies. 


Other considerations 


Additional guidance is also available if you need further 
information on: 


e Records Management 


=> see the Code of Practice under section 46 
=> see our guidance on Section 46 Code of Practice - records 
management 


e Holding information 


=> see Information held by a public authority for the purposes 
of the FOI Act 


=> see When is information caught by the FOI Act? 


More information 


This guidance will be reviewed and considered from time to time in 
line with new decisions of the Information Commissioner, Tribunals 
and courts. 


It is a guide to our general recommended approach, although 
individual cases will always be decided on the basis of their 
particular circumstances. 
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If you need any more information about this or any other aspect of 
freedom of information or data protection, please 


https://ico.org.uk/global/contact-us 
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